Description
This module exploits a command injection vulnerability in the `change_passwd` API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083.
The vulnerability allows the 'admin' privileged user account to execute arbitrary commands as the 'admin' operating system user.
Valid credentials for the 'admin' user account are required, however, this module also exploits a separate password disclosure issue which allows any authenticated user to view the password set for the 'admin' user during first install.
This module has been tested successfully on QNAP Q'Center appliance version 1.6.1075.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/qnap_qcenter_change_passwd_execmsf undefined(qnap_qcenter_change_passwd_exec) > show actions ...actions...msf undefined(qnap_qcenter_change_passwd_exec) > set ACTION < action-name >msf undefined(qnap_qcenter_change_passwd_exec) > show options ...show and set options...msf undefined(qnap_qcenter_change_passwd_exec) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub